CVE-2025-21607: Vyper Does Not Check the Success of Certain Precompile Calls

CVE-2025-21607 · Severity: medium · CVSS 4 · Published 2025-01-14

Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall execution continue. Then the execution result can be incorrect. Based on EVM's rules, after the failed precompile the remaining code has only 1/64 of the pre-call-gas left (as 63/64 were forwarded and spent). Hence, only fairly simple executions can follow the failed precompile calls. Therefore, we found no significantly impacted real-world contracts. None the less an advisory has been made out of an abundance of caution. There are no actions for users to take.

Technologies: vyper (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-21607 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-21607 being exploited in the wild.
How severe is CVE-2025-21607?
Medium severity, with a CVSS score of 4, published 14 January 2025.
Which products and versions are affected?
vyper (PyPI) ECOSYSTEM:introduced=0, ECOSYSTEM:introduced=0,fixed=0.4.1.
Is there a fix for CVE-2025-21607?
Yes. vyper (PyPI): upgrade to 0.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-21607?
Check whether you run vyper (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vyper (PyPI): upgrade to 0.4.1 or later
    pip install "vyper>=0.4.1"

Affected products

  • vyper (PyPI) ECOSYSTEM:introduced=0, ECOSYSTEM:introduced=0,fixed=0.4.1

Identifiers

  • CVE-2025-21607
  • GHSA-vgf2-gvx8-xwc3
  • PYSEC-2025-33

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.